CVE-2026-98020 pds_core: fix cmd_regs access racing BAR unmap on reset

In the Linux kernel, the following vulnerability has been resolved: pdscore: fix cmdregs access racing BAR unmap on reset pdscresetprepare and pdscresetdone's pdscmapbars error path clear/iounmap cmdregs without devcmdlock, and pdsclegacyfirmwareupdate's download loop derefs cmdregs after droppin...

CVE-2026-98020 pds_core: fix cmd_regs access racing BAR unmap on reset

In the Linux kernel, the following vulnerability has been resolved: pdscore: fix cmdregs access racing BAR unmap on reset pdscresetprepare and pdscresetdone's pdscmapbars error path clear/iounmap cmdregs without devcmdlock, and pdsclegacyfirmwareupdate's download loop derefs cmdregs after droppin...

EUVD-2026-86673

In the Linux kernel, the following vulnerability has been resolved: pdscore: fix cmdregs access racing BAR unmap on reset pdscresetprepare and pdscresetdone's pdscmapbars error path clear/iounmap cmdregs without devcmdlock, and pdsclegacyfirmwareupdate's download loop derefs cmdregs after droppin...

CVE-2026-98020

A vulnerability exists in the Linux kernel 's pds_core component where a race condition can occur during a BAR unmap on reset. Specifically, the error path in pdsc_map_bars() within pdsc_reset_prepare() and pdsc_reset_done() can clear or iounmap cmd_regs without holding the devcmd_lock. Additiona...

CVE-2026-98008 net: macb: fix NULL pointer dereference on unbind with fixed-link

In the Linux kernel, the following vulnerability has been resolved: net: macb: fix NULL pointer dereference on unbind with fixed-link When the device tree describes a fixed-link and has no "mdio" child node, macbmiiinit returns early without allocating the MDIO bus, leaving bp-miibus as NULL. Two...

CVE-2026-98008 net: macb: fix NULL pointer dereference on unbind with fixed-link

In the Linux kernel, the following vulnerability has been resolved: net: macb: fix NULL pointer dereference on unbind with fixed-link When the device tree describes a fixed-link and has no "mdio" child node, macbmiiinit returns early without allocating the MDIO bus, leaving bp-miibus as NULL. Two...

EUVD-2026-86661

In the Linux kernel, the following vulnerability has been resolved: net: macb: fix NULL pointer dereference on unbind with fixed-link When the device tree describes a fixed-link and has no "mdio" child node, macbmiiinit returns early without allocating the MDIO bus, leaving bp-miibus as NULL. Two...

CVE-2026-98008

The Linux kernel contains a NULL pointer dereference vulnerability within the net: macb driver. When the device tree describes a fixed-link without an "mdio" child node, the macb_mii_init() function returns early without allocating the MDIO bus, leaving bp->mii_bus as NULL . This causes a kern...

CVE-2026-98008

In the Linux kernel, the following vulnerability has been resolved: net: macb: fix NULL pointer dereference on unbind with fixed-link When the device tree describes a fixed-link and has no "mdio" child node, macbmiiinit returns early without allocating the MDIO bus, leaving bp-miibus as NULL. Two...

CVE-2026-97989

The Linux kernel contains a vulnerability in vduse where vduse_validate_config() fails to properly validate the vq_align parameter, checking only the upper bound. This allows invalid values to reach vring_create_virtqueue_map(). Specifically, because split-ring helpers use align - 1 as a bit mask...

CVE-2026-97989 vduse: validate virtqueue alignment

In the Linux kernel, the following vulnerability has been resolved: vduse: validate virtqueue alignment vdusevalidateconfig only checks the upper bound of vqalign. Invalid values can therefore reach vringcreatevirtqueuemap. The split-ring helpers use align - 1 as a bit mask, so the alignment must...

EUVD-2026-86643

In the Linux kernel, the following vulnerability has been resolved: vduse: validate virtqueue alignment vdusevalidateconfig only checks the upper bound of vqalign. Invalid values can therefore reach vringcreatevirtqueuemap. The split-ring helpers use align - 1 as a bit mask, so the alignment must...

CVE-2026-97989 vduse: validate virtqueue alignment

In the Linux kernel, the following vulnerability has been resolved: vduse: validate virtqueue alignment vdusevalidateconfig only checks the upper bound of vqalign. Invalid values can therefore reach vringcreatevirtqueuemap. The split-ring helpers use align - 1 as a bit mask, so the alignment must...

CVE-2026-97980 s390/debug: Fix NULL pointer dereference in debug_set_level()

In the Linux kernel, the following vulnerability has been resolved: s390/debug: Fix NULL pointer dereference in debugsetlevel Commit a2cec6863709 "s390/debug: Add s390dbf kernel parameter" incorrectly removed a null-id check from debugsetlevel, introducing a possible NULL pointer dereference for...

EUVD-2026-86634

In the Linux kernel, the following vulnerability has been resolved: s390/debug: Fix NULL pointer dereference in debugsetlevel Commit a2cec6863709 "s390/debug: Add s390dbf kernel parameter" incorrectly removed a null-id check from debugsetlevel, introducing a possible NULL pointer dereference for...

CVE-2026-97980

The Linux kernel contains a NULL pointer dereference vulnerability within the s390/debug component. The issue was caused by the incorrect removal of a null-id check in the debug_set_level() function during the addition of the s390dbf kernel parameter. This affects debug-API users who pass uncheck...

CVE-2026-97980 s390/debug: Fix NULL pointer dereference in debug_set_level()

In the Linux kernel, the following vulnerability has been resolved: s390/debug: Fix NULL pointer dereference in debugsetlevel Commit a2cec6863709 "s390/debug: Add s390dbf kernel parameter" incorrectly removed a null-id check from debugsetlevel, introducing a possible NULL pointer dereference for...

CVE-2026-97980

In the Linux kernel, the following vulnerability has been resolved: s390/debug: Fix NULL pointer dereference in debugsetlevel Commit a2cec6863709 "s390/debug: Add s390dbf kernel parameter" incorrectly removed a null-id check from debugsetlevel, introducing a possible NULL pointer dereference for...

CVE-2026-97975 Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisysfs: Fix NULL pointer dereference in devicedel A NULL pointer dereference in klistput occurs when a child device such as a BNEP network device in bnepsession is concurrently being unregistered while hciconndelsysf...

EUVD-2026-86629

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisysfs: Fix NULL pointer dereference in devicedel A NULL pointer dereference in klistput occurs when a child device such as a BNEP network device in bnepsession is concurrently being unregistered while hciconndelsysf...